A bias free true random number generator 
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We propose a new approach to nondeterministic random number generation. The randomness originated 
from the uncorrelated nature of consecutive laser pulses with Poissonian photon statistics and that of photon 
number detections is used to generate random bit, and the von Neumann correction method is used to extract 
the final random bit. This method is proved to be bias free in randomness generation provided that the single 
photon detections are mutually independent. Further, it has the advantage in fast random bit generation 
since no postprocessing is needed. A true random number generator based on this method is realized and its 
randomness is tested and guaranteed using three statistical test batteries. © 2009 Optical Society of America 
OCIS codes: 030.5260, 270.5568. 



Random numbers are essential in an extremely wide ap- 
plication range, such as statistical sampling [1], computer 
simulations [2] , randomized algorithm [3] and cryptogra- 
phy [4] . Pseudo random numbers generated with certain 
algorithms arc widely used in modern digital electronic 
information systems. Though the pseudo random num- 
ber generators (PRNG), thanks to the development of 
computer science and technology, have been highly re- 
fined in terms of generation rate and robustness against 
random test, the algorithm based PRNG can not gener- 
ate true randomness and so has the essential drawback in 
the applications which require physical randomness, such 
as quantum cryptography, which requires unpredictable 
bit strings to ensure the inability of estimation [5] . True 
random numbers should be unpredictable and unrepro- 
ducible. For this reason, physical random phenomena, 
such as the decay of radioactive nucleus [6], thermal 
noise in resistors [7], frequency jitter of electronic oscil- 
lators [8] and photon emission noise [9,10], etc., are used 
as physical sources for nondeterministic random number 
generations. Random number generator based on these 
physical random processes are termed as true random 
number generators (TRNG), and those based on photon 
emission noise extract random bit either from the ran- 
dom time intervals between photon emissions of semi- 
conductors [9] , or from the collapse of the photon wave 
function on random gating cycle [10]. In these schemes, 
the timing precision is a limitation to the random bit 
generation rate. 

In this Letter, we propose a new approach to realize a 
TRNG based on photon number detection of weak laser 
pulse. The main advantage of this new type of TRNG 
is that it has equal probabilities for the bits of ones and 
zeros and is bias free from the variability of the device 
and the environment. Moreover, this new type of TRNG 
can be realized with a simple and compact setup. It can 
generate random numbers at a high speed and is only 
limited by the repetition rate of the single photon de- 
tector (SPD). These advantages make it applicable for 
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Fig. 1. (color online) Schematic experiment set up of our 
TRNG. FA: flexible attenuator. 1: bit 1. 0: bit 0. N: not 
used. 



quantum cryptography and other applications which re- 
quire fast generation of true random bits. 

According to quantum theory of laser, the photon 
statistics for laser operating above threshold approaches 
to Poissonian [11], indicating that laser light has the 
unity second order correlation function [11] and the pho- 
ton numbers of different laser pulses arc mutually inde- 
pendent. A TRNG can be implemented based on this 
fact. Since the photon number distribution of partially 
absorbed light follows a Bernoulli transform of the initial 
field [12], provided that the detections arc mutually in- 
dependent, it can be proved that the photon numbers de- 
tected by a photodetector from weak laser pulses are also 
Poissonian distributed, i.e., Prj{n) = (r/A)" cxp(— ryA)/??.!, 
where A is the mean photon number of the weak laser 
pulses, and rj is the detection efficiency of the photode- 
tector. The probabilities of rii > 712 and ni < n2 are 
equal, where ui and 712 arc the photon numbers of two 
consecutive pulses. In experiment, we use an avalanche 
photodiode (APD) operating in gated Geiger mode for 
the photon detection, which does not distinguish the 
photon numbers above zero. Thus, we code "ni > and 
712 = 0" as bit 1 and "711 = and 712 > 0" as bit 0. 
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Then, for two consecutive detections, the probabihties 
P(l) and P{0) of generating a bit 1 and a bit 0, respec- 
tively, foUow 

= P(0) = > 0) X P„(n = 0) = e-''^(l - e""^) 

(1) 

It is then evident that the probabihties of generating the 
bits of ones and zeros are intrinsically equal and hence, 
a TRNG based on this method is physically unbiased. 

The experiment setup of our TRNG is shown in Fig. 1. 
Laser pulses (300ps@1550nm) are generated by a pulsed 
distributed feedback (DFB) diode laser (idSOO, id Quan- 
tique) , and the mean photon number of each pulse can 
be continuously adjusted by a flexible attenuator (FA). 
Photon number is detected by an InGaAs APD based 
SPD (id200, id Quantique) working in gated Geiger 
mode. The gate width of 2.5ns is chosen in experiment 
to minimize the probability of dark count. We develop 
an FPGA-based circuit for system synchronization and 
random bit extraction. The true random bits are de- 
rived from the sequence of detection signals using von 
Neumann correction method [13]. Using this method, 
we scan the random sequence from left to right read- 
ing successive pairs of photon detections. The outputs 
of "ni > and 77-2 = 0" and "ni = and 712 > 0" are 
adopted as the bits 1 and 0, respectively, while those of 
"ni > and ^2 > 0" and "ni = and 712 = 0" are 
abandoned, though they also contain randomness that 
can be extracted by other correction procedures (see, 
e.g., [14]). However, for doing this, some postprocessing 
is needed, which may greatly reduce the random bit gen- 
eration rate. We, instead, adopt von Neumann correction 
method for our TRNG because it is simple and easy to 
implement with digital logic and no postprocessing is 
needed. The repetition frequency of the generation and 
detection of laser pulses is chosen as 1 MHz, and the 
dark count probability for our SPD is measured to be 
3xl0~^ with a gate width of 2.5ns. The detection efh- 
ciency of SPD is ^10% (specification of id Quantique). 

To ensure that our TRNG generates true random bits, 
we must confirm that every single photon detection of 
the laser pulses is mutually independent. In detection, 
the after-pulse effect of APD may cause some correlation 
between two consecutive detection results. For an APD 
operating in gated Geiger mode, carriers are trapped af- 
ter every avalanche. If some of them emit during the next 
gate-on time, it can trigger a new avalanche (after-pulse) 
even though no photon is absorbed. For the detection 
with InGaAs APDs, after-pulse is frequently found when 
the repetition frequency exceeds 1 MHz. Since only traps 
with an emission lifetime comparable to or longer than 
the time interval between two consecutive gates generate 
after-pulses, we can introduce a dead time following an 
avalanche, during which, no gate is applied to the APD. 
This is an effective way to eliminate the after-pulse ef- 
fect [15]. For the SPD of our experiment, a dead time of 
8 IIS is chosen, and our experiment results show that the 
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Fig. 2. (color online) Random bit efhciency 77trng as a 
function of 77A. rj: detection efficiency of SPD; A: mean 
photon number of each laser pulse. 

probability of after-pulse is negligible and the non-signal 
counts come only from the dark counts. 

A technically important issue for TRNG is its effi- 
ciency to extract true random bit from random events, 
'7trnGi which is defined as the number of random bits 
per random event. For our TRNG, a random event is a 
photon number detection of a weak laser pulse. Thus, 
'7TRNG is equal to half of the probability that a random 
bit is generated by a pair of detections, i.e.. 
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When r]X = ln2 « 0.693, we get the optimal t^trng as 
0.25. This is also the point that the probability of detect- 
ing zero or above zero photons are equal. The value of 
?7trng varying with 77 A is illustrated in Fig. 2. It shows 
that when 77TRNG is at its maximum, it is not sensitive to 
slight fluctuations of r/X around 0.693. Experimentally, 
we adjust the flexible attenuator to the state where the 
probabilities of detecting zero and above zero photons 
are approximately equal. In this case, our TRNG gen- 
erates intrinsically unbiased random bits at the optimal 
rate permitted by the current setup. 

We use three batteries of statistical tests to evalu- 
ate the performance of our TRNG. They are ENT [16], 
DIEHARD [17] and STS [18]. We record a bit file of 
9.45 X 10* bits for the tests. The ENT resufis of our 
TRNG are: Entropy = 1.000000 bits per bit and the 
optimum compression would reduce the bit file by per- 
cent, distribution is 1.49, and randomly would exceed 
this value 22.17% of the times, arithmetic mean value of 
data bits is 0.5000 (0.5 = random), Monte Carlo value 
for TT is 3.141747714 (error 0.00 percent), serial correla- 
tion coefficient is 0.000041 (totally uncorrelated = 0.0). 
A DIEHARD test, with a data sample of 10 ~ 11 Mbytes, 
is considered succeed if 0.01 < p < 0.99 is satisfied [17]. 
For multiple p- values cases, we use a KS test to obtain a 
final p- value and the test result is based on the final p- 
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value. The results of DIEHARD test for our TRNG are 
illustrated in Fig. 3 and show that all final p- values are 
within 0.01^0.99. In STS test, the large experimental 
file is divided into 920 separate smaller streams of 10^ 
bits. An individual bit stream is usually considered to 
pass a particular test when p > 0.01 and consequently, 
98% ^ 100% of all the bit streams are expected to pass a 
particular test due to statistical fluctuations [18]. Fig. 4 
shows that all tests arc passed with the final p- values (af- 
ter KS test) above the significance level, and all testing 
results are within the confidence interval for the propor- 
tion of pass. The above three random tests show that 
our TRNG has good quality in randomness. 
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Fig. 3. (color online) Results of DIEHARD. AU testes are 
passed at lower (upper) significance level of 0.01 (0.99). 
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Fig. 4. (color online) Results of STS. All testes are passed 
at the significance level of 0.01. 



is intrinsically bias free. Its randomness is based on the 
photon number detection of weak laser pulses. Compared 
with other bias free TRNGs, e.g., those based on photon 
emission noise, the complicated timing circuits with high 
precision is not needed in our TRNG and thus is con- 
venient to be implemented. Currently, the random bit 
generation rate of our TRNG is restricted only by the 
repetition rate of our InGaAs APD based SPD. Hence, 
a faster TRNG can be experimentally implemented with 
a faster, say, silicon APD based SPD and the random bit 
generation rate can be up to Gbit/s, which is suitable for 
high speed applications. 
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